CVE-2026-50278

Summary

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.2.1 have a CIccEmbedIO::Read8() size_t underflow. The issue arises due to an embedded-profile read defect when parsing ICC profiles containing icSigEmbeddedV5ProfileTag data with icSigEmbeddedProfileType payloads. Version 2.3.2.1 patches the issue. No known workarounds are available.

Affected Software

VendorProductVersion RangeStatus
InternationalColorConsortiumiccDEV< 2.3.2.1affected

Weaknesses

  • CWE-125: CWE-125: Out-of-bounds Read
  • CWE-190: CWE-190: Integer Overflow or Wraparound
  • CWE-704: CWE-704: Incorrect Type Conversion or Cast

References